Privacy Policy

1. Scope and Definitions

This policy applies to personal information processed by DjetPay in connection with our websites, web applications, APIs, and customer support (the "Services"). "Personal information" means information that identifies or can reasonably be linked with an individual or household. We act as an independent controller/business for our own processing and, when processing your end-customer data under your instructions, as a processor/service provider.

2. Categories of Personal Information

We process the following categories, which may vary by user and use case:

• Identifiers: name, email, phone, business name, account IDs.
• Commercial/Financial: invoices, line items, amounts, currency, subscription tier, refund status; we do not store full card numbers or bank credentials.
• Customer Records: your customer contacts and recipients you choose to store.
• Internet/Technical: IP address, device and browser data, logs, diagnostic and performance metrics.
• Geolocation (coarse): derived from IP, where permitted.
• Professional: role, business details you provide.
• Audio/Visual/Docs: files you upload, e-signature artifacts, audit trails.
• Inferences: limited product analytics to improve features; no profiling for advertising.
• Sensitive information: only where you choose to upload or where required for verification; we do not use sensitive categories for marketing.

We do not knowingly collect information revealing racial or ethnic origin, health, or similar sensitive categories unless you choose to provide them in documents you upload.

3. Sources of Personal Information

• Directly from you when you create an account, issue invoices, or contact support.
• Automatically via cookies and similar technologies when you use the Services.
• From third parties, such as identity verification, payment processors, analytics, and communications providers.

4. Purposes of Use

• Provide, operate, and improve the Services and core features.
• Authenticate users; prevent fraud, abuse, and security incidents.
• Process payments, refunds, chargebacks, and payouts through third parties.
• Comply with legal obligations (for example, tax, accounting, regulatory, and KYC/AML where applicable).
• Provide customer support and communicate about updates and transactions.
• Conduct analytics to improve usability and performance.

5. Disclosures to Third Parties

We disclose personal information to service providers under contracts requiring confidentiality and appropriate safeguards. We do not sell personal information and do not share it for cross-context behavioral advertising. We may disclose to:

• Payment processors / financial institutions for transactions, disputes, and compliance.
• Vendors for hosting, storage, analytics, communications, security, identity verification, and support.
• Enterprise administrators where your account is provisioned by your organization.
• Authorities where required by law or to protect rights, safety, and the integrity of the Services.
• Successors in a merger, acquisition, financing, or sale of assets.

See our current subprocessor list at /subprocessors and our Data Processing Addendum at /legal/dpa.

6. Payments and Financial Data

Payments are processed by third parties (for example, Stripe, Inc.). DjetPay does not store full card numbers or bank account credentials. Your use of payment services is subject to the processor's terms and privacy policy. See our Payment Disclosure for fees, settlement timing, and disputes.

7. Cookies and Tracking

We and our partners use cookies and similar technologies to operate the Services, remember preferences, measure performance, and perform analytics. Manage preferences via the Cookie Preferences link in the footer and see our Cookie Notice for details.

8. Data Retention

We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Typical retention periods: account and billing records up to 7 years; product analytics up to 24 months; support communications up to 36 months, unless a longer period is required by law or for security, fraud prevention, or accounting.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure; maintain the confidentiality of your credentials and enable multi-factor authentication where available.

Additional information is available in our Security Statement.

10. International Transfers

We may process and store information in the United States and other jurisdictions where we or our vendors operate. Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses.

11. Your Rights (US and International)

Depending on your location, you may have rights to access, correct, delete, or port certain personal information, as well as to restrict or object to processing. US state laws (for example, California, Colorado, Connecticut, Utah, Virginia) and international laws (for example, GDPR) provide additional rights.

• Access, Correction, Deletion, Portability: Request via /privacy-request or email privacy@djetpay.com.
• Opt-Out of Sale/Sharing/Targeted Advertising: We do not sell personal information and do not share it for cross-context behavioral advertising. If you believe otherwise, use /do-not-sell-or-share.
• Limit Use of Sensitive Information (California): We do not use sensitive information for inferring characteristics or marketing. To exercise rights, contact us.
• Appeals (Colorado/Connecticut/Virginia): If we deny a request, you may appeal at /privacy-appeal.
• EEA/UK Legal Bases: contract performance, legitimate interests (for example, security and improvements), legal obligations, and consent where required. You may lodge a complaint with your supervisory authority.

We will verify your identity before fulfilling requests. Authorized agents may submit requests with appropriate authorization. We will not discriminate against you for exercising your rights.

12. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

13. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by law. The updated policy will be posted with a new effective date. Your continued use of the Services after the effective date constitutes acceptance.

14. Contact Us